All Apps and Add-ons

windows app hosts dropdown very large are these indexer from hosts.data ?

sonicZ
Contributor

alt textI am seeing many invalid hosts in the windows app drop down.
such as
e-805a6aa89743

i do see these on some of our indexers gathering in large meta files

$SPLUNK_HOME/var/lib/splunk/defaultdb/db/Hosts.data

Would cleaning these metadata files clear them from the dropdown?
Where else are these coming from?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

If this is from hosts.data, then you cannot really change it, the file is regenerated or extracted from each bucket.

Instead you should check the xml of the windows app page to find the search/macro used to retrieve that list and tweak it to remove the wrong host pattern. (probably a search like | metadata type=host index=os )

View solution in original post

yannK
Splunk Employee
Splunk Employee

If this is from hosts.data, then you cannot really change it, the file is regenerated or extracted from each bucket.

Instead you should check the xml of the windows app page to find the search/macro used to retrieve that list and tweak it to remove the wrong host pattern. (probably a search like | metadata type=host index=os )

sonicZ
Contributor

Yann, ok thanks i'll go this route

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...